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REMARKS 

This Application has been carefully reviewed in light of the Office Action mailed 
March 22, 2005. Claims 1-12 were pending in the Application, In the Office Action, Claims 
1-12 were rejected. In order to expedite prosecution of this Apphcation, Applicants amend 
Claims 8 and 11. Thus, Claims 1-12 remain pending in the Application. Apphcants 
respectfully request reconsideration and favorable action in this case. 

As an initial matter, Apphcants thank the Examiner for the telephone conference of 
May 23, 2005, between Examiner Lemma and James L. Baudino, during which a preliminary 
amendment filed by Applicants on January 16, 2002, was discussed. Specifically, in the 
preliminary amendment, a claim numbering discrepancy was addressed with respect to now 
pending Claims 9-12 (originally filed as Claims 10-13). In doing so, reference numerals 
appear to have been inadvertently inserted into pending Claims 9-12. However, such 
reference numeral additions did not comply with claim amendment practice at that time as 
such reference numerals were not underlined indicating the addition/insertion of such text 
into the claims. Accordingly, based on the above-identified telephone conference. Claims 9- 
12 are presented without such reference numerals as such reference numerals are deemed not 
recited by Claims 9-12. 

In the Office Action, the following actions were taken or matters were raised: 

DRAWING ORJFrTTniV 

The Examiner objected to the drawings because of informalities. Specifically, the 
Examiner states that in Figure 2, reference numbers "80" and "81," which are recited as 
"Network based IPS" on the disclosure are designated as "Network IDS". Apphcants have 
amended Figure 2 as indicated by the Examiner to replace "IDS" with "IPS" corresponding to 
reference numerals "80" and "81." Further, Applicants have amended the text associated 
with reference numeral 85 based on a similar discrepancy (e.g., replacing "IDS" with "IPS"). 
A replacement sheet of the drawing containing amended Figure 2 is attached herewith in 
Appendix A. Applicants respectfully request that this objection be withdrawn. 



Page 4 



Application Serial No. JO/001,445 



PATENT 



CT.AIM ORTFCTIONS 

The Examiner objected to Claim 8 for informalities. Specifically, Claim 8 recites 
"binding the network filter service provider to a protocol driver a the network stack of the 
node" (emphasis added). Accordingly, Applicants have amended Claim 8 to replace "a the" 
indicated above with "of the" such that Claim 8 recites "binding the network filter service 
provider to a protocol driver of the network stack of the node." Therefore, Applicants 
respectfully request that this rejection now be withdrawn. 

SFCTION 102 RFJFrTT01V5^ 

Claims 8-12 were rejected under 35 U.S.C. 102(e) as being anticipated by U.S. Patent 
No. 6,851,061 issued to Holland III et al. (hereinafter "Holland"). Applicants respectfully 
traverse this rejection. 

Of the rejected claims. Claims 8 and 11 are independent. Applicants respectfully 
submit that Holland does not disclose or even suggest each and every limitation of amended 
independent Claims 8 and 11. For example, Applicants respectfully submit that Holland does 
not disclose or even suggest a "network filter service provider implemented as an 
intermediate driver of the network stack" as recited by amended independent Claims 8 and 
11. 

Holland appears to disclose a packet filter 37 that collects all network traffic transiting 
through the network interface controller (NIC) 31 of Holland (also referred to by the 
Examiner with respect to the rejection of Claims 1-7 under 35 U.S.C. § 103 at page 8 of the 
Office Action) {Holland, column 4, lines 52-53). Holland also appears to disclose that the 
NIC 31 oi Holland is placed in standard mode such that NIC 31 copies mit all network traffic 
destined for the media access control (MAC) address {Holland, column 4, lines 53-55). 
Holland further recites: 

The packet filter 37 captures and filters the data frames. A 
stream and packet processing module 38 demultiplexes the 
filtered data frames into individual frames, datagrams, and 
packets in accordance with the network protocols supported by 
the IP stack 33. In effect, the stream and packet processing 
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module Huplicates the fiinctionfllity of the TP stark by 
reassembling raw data frames into properly formatted, higher 
protocol data packets. These data packets are collected by a 
network collector 39 for use by the analysis module 36. 

{Holland, column 4, lines 57-67, figure 2)(emphasis added). The Examiner also states that 
the "protocol driver is inherently included in the IP stack" of Holland (Office Action, page 4). 
Thus, the filter 37 oi Holland does not appear to be, or function as, an intermediate driver of a 
network stack where the network stack comprises a media access control driver and a 
protocol driver. To the contrary, the packet fiher 37 oi Holland does not appear to transfer 
any data to, or receive any data from, the IP stack 33 of Holland referred to by the Examiner 
{see, also, figure 2 of Holland), Thus, Applicants respectfiiUy submit that Holland does not 
disclose or even suggest a "network filter service provider implemented as an intermediate 
driver of the network stack" as recited by amended independent Claims 8 and 11. 
Accordingly, for at least this reason, Applicants submit that Holland does not anticipate 
amended independent Claims 8 and 11. 

Claims 9, 10 and 12 that depend respectively from independent Claims 8 and 11 are 
also not anticipated by Holland at least because they incorporate the limitations of respective 
Claims 8 and 1 1 and also additional elements that fiirther distinguish Holland, Therefore, 
Applicants respectfiilly request that the rejection of Claims 8 and 1 1, and Claims 9, 10 and 12 
that depend respectively therefrom, be withdrawn. 

SF.rTTOlV 101 RFJFrTTmv^ 

Claims 1-7 were rejected under 35 U.S.C. 103(a) as being unpatentable over Holland 
in view of U.S. Patent No. 6,826,697 issued to B. Moran (hereinafter "Moran''), Applicants 
respectfully traverse this rejection. 

Of the rejected claims, Claim 1 is independent. Independent Claim 1 recites, at least 
in part, "an operating system comprising a network stack comprising a protocol driver, a 
media access control driver and an instance of the intrusion detertinn gystprn implf>mpntf>H ag 
a n intfirmediatfi drivf^r and bound to the protocol driver and the media access control driver" 
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(emphasis added). In the Office action, and as discussed above, the Examiner appears to 
consider the packet filter 37 of Holland as an "intermediate driver" of a network stack 
comprising a protocol driver and a media access control driver where "the MAC driver ... is 
inherently included in the NIC and ... the protocol driver ... is inherently included in the IP 
stack" (Office Action, page 8). As discussed above, Applicants respectfully submit that the 
packet filter 37 of Holland is not an "intermediate driver" of a network stack comprising a 
protocol driver and a media access control driver. Further, Moran does not appear to remedy 
at least this deficiency of Holland. Accordingly, Applicants respectfully submit that Claim 1, 
and Claims 2-7 that depend therefi-om, are patentable over the cited references. 
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Applicants have made an earnest attempt to place this case in condition for immediate 
allowance. For the foregoing reasons and for other reasons clearly apparent, Applicants 
respectfully request reconsideration and full allowance of all pending claims. 

No fee is believed due with this Response. If, however. Applicant has overlooked the 
need for any fee due with this Response, the Commissioner is hereby authorized to charge any 
fees or credit any overpayment associated with this Response to Deposit Account No. 08- 
2025 of Hewlett-Packard Company. 



Date: Tnnp 99 700^ 

Correspondence to: 

L.Joy Griebenow 

Hewlett-Packard Company 

Litellectual Property Administration 

P. O. Box 272400 

Fort Collins, CO 80527-2400 

Tel. 970-898-3884 



Respectfully submitted. 
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